Loading npm security reports…

crypto-javas@2.0.7: Malicious npm security report (Block) | LPM Firewall

registry / crypto-javas / 2.0.7

crypto-javas@2.0.7

Secure environment variable handler for GitLab CI/CD pipelines

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The install hook harvests environment variables and CI metadata, then exports them over HTTPS when backend configuration is found. Importing `index.js` repeats the same behavior at runtime.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; also importing the package

Impact

CI secrets, tokens, backend API keys, repository metadata, and host details can be disclosed.

Mechanism

automatic credential/environment harvesting and HTTPS exfiltration

Attack narrative

On npm installation, `setup.js` enumerates almost every environment variable, builds a text report containing their values plus CI and host metadata, and POSTs it to a backend URL discovered from the installation environment or project files. The hook includes the backend API key in the captured environment set. The main module performs comparable harvesting and exfiltration automatically when imported, without an explicit API call.

Rationale

This is concrete, unconsented install-time credential exfiltration, not merely a user-invoked secrets utility. The configurable endpoint does not remove the risk because the package automatically reads and transmits broad secret material.

Evidence

package.jsonsetup.jsindex.jsREADME.md.crypto-config.json.env

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `node setup.js` via `postinstall`.
`setup.js` collects nearly all process environment variables during install.
`setup.js` reads backend configuration from env, project `package.json`, `.crypto-config.json`, or `.env`.
`setup.js` POSTs a formatted dump of captured variables and CI metadata to that backend.
`index.js` repeats collection and transmission automatically on module import.
`README.md` documents a different package name and omits automatic network export.

Evidence against

No hard-coded external endpoint is present; the destination is configuration-controlled.
No filesystem writes, shell execution, payload download, or persistence code was found.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 11.0 KB of source

Source & flagged code

1 flagged

package.jsonView file

•scripts.postinstall = node setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem